WHAT IS CLAIMED IS; 



1. A network monitoring system for monitoring a 
communication state on a network in which action explanation 
5 information for explaining a single action is divided into a 
plurality of packets, the network monitoring system comprising : 
a data acquisition section for acquiring the plurality 
of packets flown on the network; 

a data analysis section for acquiring the action 
10 explanation information from the plurality of packets acquired 
by the data acquisition section; and 

a display-information generation section for generating 
display information, which is used to display the single action 
on the network on a single screen on the basis of the action 
15 explanation information acquired by the data analysis section. 

2. The network monitoring system according to claim 
1, wherein the action explanation information is defined in 
advance . 

20 

3. The network monitoring system according to claim 
1, wherein the data analysis section identifies kinds of the 
packets acquired by the data acquisition section and acquires 
the action explanation information from the packets on the basis 

25 of the identified kinds of the packets. 



25 



4 . The network monitoring system according to claim 
1, wherein the action explanation information includes sending 
source computer information, destination computer information, 
and action information. 

5. The network monitoring system according to claim 
1, further comprising: 

an analysis data storage section for storing the action 
explanation information acquired by the data analysis section, 
wherein: 

the display-information generation section regenerates 
the display information used to play back and display the action 
explanation information stored by the analysis data storage 
section in response to a request of a user. 

6. The network monitoring system according to claim 
5, wherein: 

the action explanation information stored by the analysis 
data storage section includes time information, which 
corresponds to time at which the single action was performed; 
and 

the display-information generation section regenerates 
the display information used to play back and display the action 
explanation information stored by the analysis data storage 



section in accordance with the time information, in response 
to a request of a user. 

7. The network monitoring system according to claim 
5, wherein the display-information generation section 
continuously plays back and displays the action explanation 
information stored by the analysis data storage section at the 
same time interval to an accuracy of 500 msec as the action 
was executed, in response to a request of a user. 

8 . The network monitoring system according to claim 
1, wherein the display-information generation section extracts 
and generates the display information in accordance with display 
setting by a user. 

9. A network monitoring method for monitoring a 
communication state on a network in which action explanation 
information for explaining a single action is divided into a 
plurality of packets, the method comprising: 

acquiring the plurality of packets flown on the networks- 
acquiring the action explanation information from the 
plurality of acquired packets; and 

generating display information, which is used to display 
the single action on the network on a single screen on the basis 
of the acquired action explanation information. 
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10. The network monitoring method according to claim 
9, wherein the action explanation information is defined in 
advance . 

11. The network monitoring method according to claim 
9, wherein in the acquisition of the action explanation 
information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation 
information is acquired from the packets on the basis of the 
identified kinds of the packets. 

12. The network monitoring method according to claim 
9, wherein the action explanation information includes sending 
source computer information, destination computer information, 
and action information. 

13. The network monitoring method according to claim 
9, further comprising: 

storing the acquired action explanation information, 
wherein: 

in the generation of the display information, the display 
information is regenerated, the regenerated display 
information used to play back and display the stored action 
explanation information in response to a request of a user. 
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14. The network monitoring method according to claim 
13, wherein: 

the stored action explanation information includes time 
5 information, which corresponds to time at which the single action 
was performed; and 

in the generation of the display information, the display 
information is regenerated, the regenerated display 
information used to play back and display the stored action 
10 explanation information in accordance with the time information 
in response to a request of a user. 

15. The network monitoring method according to claim 
13, further comprising continuously playing back and displaying 

15 the stored action explanation information at the same time 
interval to an accuracy of 500 msec as the action was executed 
in response to a request of a user. 

16. The network monitoring method according to claim 
20 9, wherein in the generation of the display information, the 

display information is extracted and generated in accordance 
with display setting by a user. 

17. A network monitoring program for monitoring a 
25 communication state on a network in which action explanation 
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information for explaining a single action is divided into a 
plurality of packets, the program making a computer perform 
a process comprising: 

acquiring the plurality of packets flown on the networks- 
acquiring the action explanation information from the 
plurality of acquired packets; and 

generating display information, which is used to display 
the single action on the network on a single screen on the basis 
of the acquired action explanation information. 

18. The network monitoring program according to claim 
17, wherein the action explanation information is defined in 
advance . 

19. The network monitoring program according to claim 
17, wherein in the acquisition of the action explanation 
information, kinds of the packets acquired by the packet 
acquisition are identified and the action explanation 
information is acquired from the packets on the basis of the 
identified kinds of the packets. 

20. The network monitoring program according to claim 
17, wherein the action explanation information includes sending 
source computer information, destination computer information, 
and action information. 
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21 . The network monitoring program according to claim 
17, wherein: 

the process further comprises storing the acquired action 
explanation information; and 

in the generation of the display information, the display 
information is regenerated, the regenerated display 
information used to play back and display the stored action 
explanation information in response to a request of a user. 

22. The network monitoring method according to claim 
21, wherein: 

the stored action explanation information includes time 
information, which corresponds to time at which the single action 
was performed; and 

in the generation of the display information, the display 
information is regenerated, the regenerated display 
information used to play back and display the stored action 
explanation information in accordance with the time information 
in response to a request of a user. 

23. The network monitoring program according to claim 
21, wherein the process further comprises: 

continuously playing back and displaying the stored 
action explanation information at the same time interval to 
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an accuracy of 500 msec as the action was executed in response 
to a request of a user. 

24. The network monitoring program according to claim 

11, wherein in the generation of the display information, the 
display information is extracted and generated in accordance 
with display setting by a user. 
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